What is svchost.exe?

svchost.exe (Service Host, or SvcHost) is a system process that hosts multiple Windows services in the Windows NT family of operating systems.Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption

Issue

Hard-drive stays busy.

Indicator

Task Manager

Image

Explanation

Top IO Usage

svchost.exe

Process ID is 920

User name is System

SysInternals

Explanation

Top IO Usage

svchost.exe

Process ID is 920

User name is System

TroubleShooting

Process Management

Tasklist

List all services running under svchost.exe

Tasklist – List all processes running under svchost.exe

Script

tasklist /svc /fi "imagename eq svchost.exe"

Output

Explanation

We are focused on PID = 920

Process Explorer

Tasklist – Dig deeper into process svchost.exe = 920

Services

Own Process

In a nice Server Fault QA post, Peter Mortensen suggested that one could separate out the services into their own process and thus gain clearer understanding of each service resource uptake.